Subnetting 101: Dividing Your Network for Efficiency and Security

Imagine an apartment complex where each building needs its own address range and access rules. Subnetting does something similar for IP addresses: it divides a larger range into smaller, clearly defined networks. The arithmetic tells you which addresses belong together; the network equipment and policy determine how traffic can move between them.

What Is Subnetting?

A subnet is an IP prefix shared by a set of interfaces. In IPv4, an address has 32 bits, usually displayed as four decimal octets, such as 192.168.1.70. A prefix length or subnet mask identifies how many leading bits form the network portion.

/26 means 26 network bits and six remaining bits. The corresponding mask is 255.255.255.192: its final octet is binary 11000000. Those six host bits produce 64 address combinations. The binary ones and zeros belong to the mask's representation; a normal dotted-decimal mask is not written as a string of decimal 1s and 0s.

RFC 4632 describes this classless prefix notation. Modern planning uses the explicit prefix, rather than inferring a fixed network size from an old Class A, B or C label.

Why Subnet?

• Organisation: Maintain separate address plans for management, servers, trusted clients and guests.
• Capacity planning: Choose a range that accommodates the devices, router interfaces and expected growth.
• Policy boundaries: Route between defined networks through equipment that can enforce the access rules you need.
• Broadcast management: Separate Layer 2 segments, often VLANs, contain local broadcast traffic. Changing IP masks alone on one shared Ethernet segment does not create those boundaries.

Subnetting is therefore useful infrastructure for segmentation, but a different subnet number is not a firewall. If a router freely routes between two networks, devices can communicate across them. The security benefit comes from the complete design, including the actual segments and enforced rules.

Do You Need It at Home?

A small network may be simpler with one trusted LAN plus a supported guest network. More segmentation becomes useful when you have administration interfaces, internet-facing services, cameras or other devices with different trust requirements. Start from a specific goal: for example, guests should reach the internet but not your NAS or router administration page.

Check your router, switch and access points before planning VLANs. A consumer guest feature may have its own isolation behaviour, while an unmanaged switch cannot provide the same configurable VLAN layout as a managed one. A diagram is only useful if the hardware and firmware can implement it.

Segmenting also has a cost in configuration and troubleshooting. Discovery-based printers, casting devices and smart-home services may no longer find each other across a boundary. Identify the service and direction needed before opening broad access between all networks just to make one device work.

Plan the Address Space

1. List requirements: Count client devices, infrastructure addresses and reserved space. A gateway address consumes one usable address too.
2. Choose an appropriate parent range: For internal IPv4 use the RFC 1918 private ranges: 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. Check overlap with existing LANs, VPNs and container networks.
3. Select prefix sizes: Smaller numerical prefix lengths provide larger ranges; larger lengths provide smaller ranges. Equal-sized subnets are easy to illustrate, but variable-sized subnets may suit differing needs.
4. Calculate boundaries: Set host bits to zero for the network address and to one for the conventional IPv4 broadcast address. A network address need not end in .0.
5. Allocate services: Record gateway, DHCP pool, static addresses, DNS and intended routing policy for each segment.

IPv4 Prefix Reference

For a conventional broadcast-capable IPv4 subnet, the total size is 2^(32 − prefix) and the usual assignable count is two fewer, reserving network and broadcast addresses. This rule has important exceptions.

RFC 3021 permits both addresses of a supported /31 point-to-point link to be endpoint addresses. A /32 represents one address, commonly a host route. Do not apply the subtract-two rule universally or carry the IPv4 broadcast model over to IPv6.

The table gives address counts, not a recommended device count or workload rating. A storage cluster, camera network or VPN does not inherently require one particular prefix. Size it from its requirements and supported topology.

Worked Example: Four /26 Networks

Starting with 192.168.1.0/24, extend the prefix by two bits to make four equal /26 blocks. Each contains 64 addresses, with 62 conventional usable addresses. The final-octet boundaries advance by 64:

For example, 192.168.1.70/26 belongs to 192.168.1.64/26, not 192.168.1.0/26. You might use 192.168.1.65 for that segment's router and reserve further addresses for infrastructure. The remaining client count is then less than 62; the table's total does not mean 62 clients plus a separate free gateway.

If a device mistakenly keeps a /24 mask while the intended segment is /26, it may treat destinations in the other three blocks as local and try to reach them directly instead of through its gateway. Consistent client masks matter as much as the router's address plan.

Subnets, VLANs, Routing and Firewalls

A VLAN defines a Layer 2 broadcast domain; a subnet defines an IP address range. A common straightforward design assigns one IP subnet to each VLAN and routes between them. They are related, but neither term is a synonym for the other. Cisco's inter-VLAN example distinguishes routing from the ACL that restricts access to a sensitive server.

Instead of four /26 blocks, a private home network can choose memorable separate /24 ranges, if space and topology allow. For instance, VLAN 10 could use 10.10.10.0/24 for management and VLAN 20 could use 10.10.20.0/24 for servers. Matching a VLAN number to an octet is an optional naming convention, not a protocol requirement.

Specify permitted flows before configuring rules. A trusted client might need one NAS service, while a guest may need only DNS, DHCP and internet access. Decide where DNS is hosted and how a remote DHCP service is reached. A rule described as “IoT blocked from management” must actually be implemented and tested, including IPv6 if that protocol is active.

Verify the Result

Move one test client first and retain a way to reach router management. Check its address, mask, gateway and DNS against your plan. Test a permitted local service, internet access and an explicitly prohibited destination. A failed ping alone is insufficient evidence of a complete firewall policy: a host may simply decline ICMP while another service remains reachable.

Watch for duplicate static addresses, DHCP pools overlapping reservations, inconsistent VLAN tagging and overlapping routed networks. Use client settings, route information and relevant logs to identify the failure instead of expanding masks until something happens to connect. Change one element at a time and record what the change achieved.

Benefits and Trade-Offs

The benefits are clearer management, flexible growth and a structure for enforceable policy. The trade-offs are additional equipment capabilities, address planning, configuration and discovery troubleshooting. Smaller ranges do not automatically make an internet connection faster, and a large device count is not the only reason to segment.

Conclusion

Learn the prefix arithmetic, then connect it to the actual Layer 2 segments, routing and access rules. Keep an address plan and verify both allowed and blocked flows. For the name-resolution part of that design, see our guide on DNS.